Change the Grafana admin password

The fix/etc/grafana/grafana.ini

[security]
admin_user = grafana_admin
admin_password = $__env{GF_SECURITY_ADMIN_PASSWORD}

sudo grafana-cli admin reset-admin-password "$(openssl rand -base64 24)"

What the default is

Straight from Grafana’s defaults.ini:

admin_user = admin
admin_password = admin

The admin account is a Grafana Server Admin — the highest privilege level there is. It manages every organisation, every user, and every data source, which means it also holds the ability to read from and write to the systems those data sources point at.

Grafana prompts for a change at first login. That prompt is the reason this is widely assumed to be handled, and the reason it frequently is not: it can be dismissed, and it only applies to interactive first logins. An instance provisioned by configuration management, started from a container image, or brought up as part of a stack nobody logged into individually keeps admin/admin indefinitely.

Change the username too

admin_user = admin is as predictable as the password, and a known username halves the work for anyone attempting credentials. Renaming it does not stop a determined attacker — it does remove you from the bucket that automated credential stuffing is aimed at.

Brute-force protection is on by default (disable_brute_force_login_protection = false, five attempts), so a slow guessing attack is already constrained. That is a reason to relax about throttling, not about the default password — protection against guessing does not help when the credential does not need to be guessed.

Keep the password out of the file

grafana.ini is readable by the grafana user and lands in configuration management, backups and container images. Grafana supports environment interpolation so the value need not be in the file:

admin_password = $__env{GF_SECURITY_ADMIN_PASSWORD}

In containers the environment variable alone is enough — GF_SECURITY_ADMIN_PASSWORD overrides the file with no grafana.ini change at all. Make sure it comes from a secret store rather than a committed compose file, since docker inspect prints the environment of a running container to anyone in the docker group — which is root on the host.

Better: don’t use the admin account

The shared admin login is a break-glass account. Day-to-day access should be individual accounts, ideally from your identity provider (OAuth, SAML or LDAP), so that access is revoked when someone leaves and actions are attributable.

Grafana can be told not to create the built-in admin at all when an external provider is in place:

[security]
disable_initial_admin_creation = true

Only do this once external authentication is confirmed working. Setting it on a fresh instance with no other login path produces a Grafana nobody can get into.

Verify it worked

The blunt test — try the default from another host:

curl -sS -u admin:admin https://grafana.example.com/api/org

A JSON organisation object means the default credential is live. Expect {"message":"invalid username or password"}.

Check what the running instance was configured with, remembering that environment variables win:

grep -A3 '^\[security\]' /etc/grafana/grafana.ini
docker inspect grafana --format '{{range .Config.Env}}{{println .}}{{end}}' | grep GF_SECURITY

List every Server Admin, which is the account class that matters:

curl -sS -u "$GF_ADMIN_USER:$GF_ADMIN_PASS" \
  https://grafana.example.com/api/org/users | \
  python3 -c 'import json,sys; [print(u["login"], u["role"]) for u in json.load(sys.stdin)]'

Anything with Admin that you do not recognise is the finding.

Before you apply this

Changing the admin password is low-risk for people and higher-risk for automation. Anything using that credential to talk to the API — provisioning scripts, Terraform, backup jobs, a CI pipeline that uploads dashboards — breaks at the moment you change it.

Find them before you do:

sudo grep -rn 'admin:admin\|GF_SECURITY_ADMIN' /etc /opt /srv --include='*.y*ml' --include='*.env' 2>/dev/null
sudo journalctl -u grafana-server --since '7 days ago' | grep -i 'login' | tail -50

The durable fix for automation is not a shared password at all — it is a service account token, which is scoped, individually revocable, and does not break when a human rotates their own credentials. Create those first, migrate automation onto them, then change the admin password.

grafana-cli admin reset-admin-password needs to run as a user that can read the Grafana database and, on most installs, be followed by a restart:

sudo -u grafana grafana-cli admin reset-admin-password 'NEW_PASSWORD'
sudo systemctl restart grafana-server

If you lock yourself out entirely, that same command run locally on the host is the way back in — which is worth remembering as a risk, since anyone with shell access to the Grafana host can reset the admin password without knowing the old one.

Related

• Rotate the Grafana secret key — the default that matters more than this one.
• Data source credential theft — what an admin session is actually worth.